Module macho 

Mach-O reader and writer with byte-identical round-trip.

v1 covers thin (non-fat) 64-bit little-endian Mach-O images for both x86-64 and arm64. The parsed representation captures the structured header and each load command’s (cmd, cmdsize) prefix; load command bodies stay as opaque bytes so the suite of cmd kinds (LC_SEGMENT_64, LC_SYMTAB, LC_CODE_SIGNATURE, LC_DYLD_CHAINED_FIXUPS, …) round-trip without needing per-cmd decoders.

Contract: for any supported input bytes, MachoFile::parse(bytes)?.write_to_vec() == bytes.

Fat (universal) wrappers and 32-bit Mach-O are out of scope for v1. Section contents (the bytes inside __text, __data, etc.) are never interpreted here — that belongs to the arch backends and analysis crates.

Structs

BuildVersionTool

LcBuildVersion

Body of LC_BUILD_VERSION. Records the platform / minimum OS / SDK / per-tool versions. ntools is recovered from tools.len() at encode time.

LcDylib

Body of LC_LOAD_DYLIB / LC_ID_DYLIB / LC_LOAD_WEAK_DYLIB / LC_REEXPORT_DYLIB. The same 4-u32 dylib record followed by the NUL-padded name string.

LcDylinker

Body of LC_LOAD_DYLINKER (and the analogous LC_ID_DYLINKER — same shape). The offset is from the start of the command (including the cmd/cmdsize prefix), which in the canonical linker output is 0xc — i.e. the name begins at body offset 4. name holds the C string up to (but not including) the first NUL; tail_padding carries the NUL + any trailing alignment NULs verbatim, so the encoded length always matches the original.

LcDysymtab

Structurally decoded body of an LC_DYSYMTAB command — 18 u32s describing partitions of the LC_SYMTAB table and auxiliary indirect-symbol / module / reference tables.

LcLinkeditData

Body of every linkedit_data_command-shaped load command (LC_CODE_SIGNATURE, LC_FUNCTION_STARTS, LC_DATA_IN_CODE, LC_DYLD_EXPORTS_TRIE, LC_DYLD_CHAINED_FIXUPS, …).

LcMain

Body of LC_MAIN. Entry-point offset + initial stack size.

LcSourceVersion

Body of LC_SOURCE_VERSION: one packed 64-bit version.

LcSymtab

Structurally decoded body of an LC_SYMTAB command. Four u32s sized exactly 16 bytes on disk.

LcUuid

Body of LC_UUID: 16 raw bytes.

LoadCommand

One load command from the table that follows the file header.

MachHeader64

Parsed 64-bit Mach-O header.

MachoFile

A parsed thin 64-bit Mach-O file in a form that round-trips byte-identically.

Section64

A section_64 entry within an LC_SEGMENT_64. Field naming matches Apple’s struct verbatim.

Segment64

A LC_SEGMENT_64 descriptor, structurally decoded enough to drive segment-data extraction and the decompile path’s section iteration. The raw bytes still round-trip through the matching LoadCommand::body.

Enums

Error

Errors surfaced when parsing or writing a Mach-O file.

MachoCpu

Architecture flavour the parsed Mach-O targets.

Constants

CPU_TYPE_ARM64

CPU_TYPE_X86_64

cputype values for the architectures v1 supports.

FAT_MAGIC

Fat-arch wrapper magic (big-endian). Detected so callers can route appropriately; v1 parse refuses.

FAT_MAGIC_64

LC_BUILD_VERSION

LC_BUILD_VERSION: platform / minimum-OS / SDK / toolchain.

LC_CODE_SIGNATURE

linkedit_data_command kinds. All share the same 4 + 4 + 4 + 4 body shape: cmd + cmdsize prefix already eaten, then body = dataoff (u32) + datasize (u32).

LC_DATA_IN_CODE

LC_DYLD_CHAINED_FIXUPS

LC_DYLD_EXPORTS_TRIE

LC_DYLIB_CODE_SIGN_DRS

LC_DYSYMTAB

LC_DYSYMTAB: extended dynamic-link symbol info. Body is 18 u32s describing partitions of the LC_SYMTAB table plus auxiliary indirect-symbol / module / reference tables.

LC_FUNCTION_STARTS

LC_ID_DYLIB

LC_ID_DYLIB: identifies this image when it is itself a dylib.

LC_LINKER_OPTIMIZATION_HINT

LC_LOAD_DYLIB

LC_LOAD_DYLIB: dependent dynamic library. Body is a dylib_command after the cmd/cmdsize prefix.

LC_LOAD_DYLINKER

LC_LOAD_DYLINKER: file path of the dynamic linker. Body is a lc_str offset (u32) followed by the NUL-padded name.

LC_LOAD_WEAK_DYLIB

LC_LOAD_WEAK_DYLIB: dependent library, weak link.

LC_MAIN

LC_MAIN: entry-point load command. Body is entryoff (u64)

LC_REEXPORT_DYLIB

LC_REEXPORT_DYLIB: dependent library to re-export.

LC_REQ_DYLD

Bit OR’d into cmd to mark a command as required for correct dynamic linker behaviour. Not a kind by itself; ORed with the concrete LC_* value.

LC_SEGMENT_64

LC_SEGMENT_64 load-command kind. Carries a segment descriptor plus that segment’s sections.

LC_SOURCE_VERSION

LC_SOURCE_VERSION: 64-bit packed source-control version.

LC_SYMTAB

LC_SYMTAB: classical symbol-table command. Body is four u32s: symoff, nsyms, stroff, strsize.

LC_UUID

LC_UUID: 16-byte randomly-generated identifier baked into the binary at link time.

MH_MAGIC

32-bit little-endian Mach-O magic (detected; v1 parse refuses).

MH_MAGIC_64

64-bit little-endian Mach-O magic.

Functions

is_dylib_cmd

True when cmd is one of the dylib-shaped load commands.

is_fat

True when bytes are a fat (universal) Mach-O wrapper. Not supported by v1 parse, but exposed so callers can route around it.

is_linkedit_data_cmd

True when cmd is one of the linkedit_data_command-shaped load commands (the 4+4-byte body pattern).

is_macho

True when bytes start with any Mach-O magic — thin 32- or 64-bit, either endian, plus the fat (universal) wrapper. Doesn’t say whether v1 will accept the file (use is_macho64 for that gate).

is_macho32

True when bytes are a thin 32-bit little-endian Mach-O. Detected so callers can route around it; v1 parse refuses.

is_macho64

True when bytes are a thin 64-bit little-endian Mach-O — the flavour MachoFile::parse handles. Callers that route by format should gate on this and fall through to a byte-copy for unsupported variants so the round-trip contract still holds.

Type Aliases

Result